CVE-2025-26373

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier

Description: The issue is related to a missing authorization error, allowing an authenticated attacker with low privileges to enumerate users through crafted HTTP requests to the maxprofile/users/routes.lua user endpoint.

Recommendations: For versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxprofile/users/routes.lua endpoint to minimize the risk of exploitation.